278049 matches found
ROS-20261006-73-0441
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-105985: Improper Neutralization of Special Elements Used in a Template Engine
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
PT-2026-106783
Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions prior to 4.0.0-canary.34 Description An access-control bypass exists in the duplicate operation, which allows the copying of values from a source document even if a field is hidden or if t...
CVE-2026-105851: Improper Access Control
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that val...
ROS-20261006-73-0126
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-106285
Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description An issue exists when SSSD is configured to enforce account expiration using LDAP Lightweight Directory Access Protocol shadow attributes. The system fails to recognize an expiration value of zer...
CVE-2026-105855: Improper Access Control
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions...
ROS-20261006-73-0449
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
Privilege Escalation / Access Control Bypass in Brocade Fabric OS Web Management Framework (CVE-2026-94575)
: A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for...
PT-2026-106708
Name of the Vulnerable Software and Affected Versions Craft CMS version 5.10.13.2 Description An authenticated remote code execution issue exists in the Control Panel action 'app/render-components'. Users with basic Control Panel access can submit request-controlled component classes and property...
Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing
: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...
PT-2026-106372
Unauthenticated Broken Access Control in PowerPress Podcasting = 11.17.9 versions...
CVE-2026-39794: Missing Authorization
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...
PT-2026-111243
Уязвимость интерфейса Appliance WorkPlace микропрограммного обеспечения межсетевых экранов SonicWall SMA1000 связана с возможностью обхода механизмов контроля доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить SSRF-атаку и получить несанкционированный...
CVE-2026-39749: Missing Authorization
Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...
CVE-2026-39787: Missing Authorization
Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...
A race condition vulnerability exists in the web management daemon on Brocade Fabric OS versions before 10.0.1 (CVE-2026-94584)
: A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP...
CVE-2026-105764: Improper Control of Generation of Code
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...